本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
先決條件
開始之前，請先完成以下先決條件：
-
使用 Studio 存取加入 SageMaker AI 網域。如果您沒有將 Studio 設定為網域預設體驗的許可，請聯絡您的管理員。如需詳細資訊，請參閱 Amazon SageMaker AI 網域概觀。
-
AWS CLI 依照安裝目前 AWS CLI 版本中的步驟更新 。
-
從您的本機電腦執行
aws configure並提供您的 AWS 登入資料。如需 AWS 登入資料的資訊，請參閱了解並取得您的 AWS 登入資料。
所需的 IAM 許可
SageMaker AI 模型自訂需要將適當的許可新增至 SageMaker AI 執行角色。
透過主控台設定許可
如果您透過主控台建立 SageMaker AI 網域，模型自訂的許可會根據您的設定方法自動處理：
-
快速設定 — 預設包含模型自訂許可。不需要額外的組態。
-
自訂設定 — 在設定執行角色時，選取模型自訂 ML 活動。如需 ML 活動及其授予之許可的詳細資訊，請參閱設定 IAM 角色的 ML 活動。
手動設定許可
如果您透過 AWS CLI、 SDK 或 CloudFormation 設定網域，或需要將模型自訂許可新增至現有的執行角色，請使用下列其中一個選項。
選項 1 （建議）：連接 AWS 受管政策
將 AmazonSageMakerModelCustomizationCoreAccess 受管政策連接至您的 SageMaker AI 執行角色。此政策涵蓋基本模型自訂所需的所有許可，包括無伺服器訓練、自訂獎勵函數 RL、模型評估，以及部署到 SageMaker AI 或 Bedrock 端點。如需連接政策的資訊，請參閱 Identity and AWS Access Management 使用者指南中的新增和移除 IAM 身分許可。
選項 2：建立內嵌政策
如果您想要手動管理許可，請使用下列 JSON 建立內嵌政策，並將其連接至您的執行角色：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerPublicHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListHubContents" ], "Resource": [ "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" ] }, { "Sid": "SageMakerHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:ImportHubContent", "sagemaker:ListHubs", "sagemaker:ListHubContents", "sagemaker:ListHubContentVersions", "sagemaker:DescribeHubContent", "sagemaker:DeleteHubContent" ], "Resource": [ "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "JumpStartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::jumpstart*" ] }, { "Sid": "SageMakerTrainingJob", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:ListTrainingJobs", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMLFlow", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowApp", "sagemaker:DescribeMlflowApp", "sagemaker:CreatePresignedMlflowAppUrl", "sagemaker:CallMlflowAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetLoggedModel", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:UpdateRun" ], "Resource": [ "arn:aws:sagemaker:*:*:mlflow-app/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BYODataSetS3Access", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerModelPackage", "Effect": "Allow", "Action": [ "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:UpdateModelPackage", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:DescribeModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerLineage", "Effect": "Allow", "Action": [ "sagemaker:CreateAction", "sagemaker:CreateArtifact", "sagemaker:CreateContext", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:QueryLineage", "sagemaker:AddAssociation", "sagemaker:UpdateArtifact" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:pipeline/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerPipelines", "Effect": "Allow", "Action": [ "sagemaker:CreatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:UpdatePipeline", "sagemaker:StartPipelineExecution" ], "Resource": [ "arn:aws:sagemaker:*:*:pipeline/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInference", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateInferenceComponent", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteEndpoint", "sagemaker:InvokeEndpoint" ], "Resource": [ "arn:aws:sagemaker:*:*:inference-component/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInferenceAutoscaling", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "arn:aws:application-autoscaling:*:*:scalable-target/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInferenceEcrReadAccess", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListActions", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListEndpoints", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowApps", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListWorkforces", "sagemaker:Search" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerTagsPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:inference-component/*", "arn:aws:sagemaker:*:*:action/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerJobAdvancedSettings", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "ec2:DescribeVpcs" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogReadAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/*", "arn:aws:logs:*:*:log-group::log-stream:" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogWriteAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaListFunctions", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaPermissionsForRewardFunction", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:InvokeFunction", "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaLayerForAWSSDK", "Effect": "Allow", "Action": [ "lambda:GetLayerVersion" ], "Resource": [ "arn:aws:lambda:*:336392948345:layer:AWSSDK*" ] }, { "Sid": "BedrockCustomModelAndEvaluation", "Effect": "Allow", "Action": [ "bedrock:CreateCustomModel", "bedrock:CreateEvaluationJob", "bedrock:GetCustomModel", "bedrock:GetModelImportJob", "bedrock:GetImportedModel", "bedrock:GetEvaluationJob", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:evaluation-job/*", "arn:aws:bedrock:*:*:imported-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:model-import-job/*", "arn:aws:bedrock:*:*:foundation-model/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockModelImportAndList", "Effect": "Allow", "Action": [ "bedrock:CreateModelImportJob", "bedrock:ListProvisionedModelThroughputs", "bedrock:ListCustomModelDeployments", "bedrock:ListCustomModels", "bedrock:ListModelImportJobs" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockFoundationModelOperations", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModelAvailability", "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "PassRoleForSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/*SageMaker*", "arn:aws:iam::*:role/service-role/*Sagemaker*", "arn:aws:iam::*:role/service-role/*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "job.sagemaker.amazonaws.com" ] }, "ArnLike": { "iam:AssociatedResourceArn": "arn:aws:sagemaker:*:*:*" } } }, { "Sid": "PassRoleForAWSLambda", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/SageMakerForLambda*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" }, "ArnLike": { "iam:AssociatedResourceArn": "arn:aws:lambda:*:*:function:*" } } }, { "Sid": "PassRoleForBedrock", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/SageMakerForBedrock*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } } ] }
Lambda 和 Bedrock 的角色
除了 SageMaker AI 執行角色的許可之外，模型自訂還需要兩個其他服務的角色：
-
Lambda — 在以 RL 為基礎的訓練期間執行自訂獎勵函數
-
Bedrock：匯入自訂模型以進行部署時，從 S3 讀取模型成品
如果您先前已設定執行角色 （舊版方法）
如果您先前遵循本文件，並更新 SageMaker AI 執行角色的信任政策，以包含 lambda.amazonaws.com和 bedrock.amazonaws.com做為信任的服務主體，則您現有的組態會繼續運作。不需要變更。
若要使用此方法，您的執行角色的信任政策必須包含下列服務主體：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sagemaker.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
注意
這種方法較不安全，因為 Lambda 和 Bedrock 可以擔任您的執行角色並繼承其所有許可，而不只是每個服務需要的許可。
建立個別角色 （建議）
為了提高安全性，請建立兩個單獨的縮小範圍 IAM 角色，一個用於 Lambda，另一個用於 Bedrock，而不是將這些服務主體新增到 SageMaker AI 執行角色。每個角色僅信任其個別的服務，且僅包含服務所需的最低許可。
如果您透過 SageMaker AI 主控台快速設定來設定網域，系統會自動建立這些角色。如果您透過其他方法設定網域，請使用下列步驟手動建立網域。
Lambda 角色
此角色允許 Lambda 在以 RL 為基礎的模型自訂期間執行自訂獎勵函數。
命名慣例： SageMakerForLambda-{domain-id}
-
使用下列信任政策建立 IAM 角色。將 取代
<ACCOUNT_ID>為您的 12 位數 AWS 帳戶 ID。{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<ACCOUNT_ID>" }, "ArnLike": { "aws:SourceArn": "arn:aws:lambda:*:<ACCOUNT_ID>:function:*" } } } ] } -
將
AWSLambdaBasicExecutionRoleAWS 受管政策連接至角色。這會授予將日誌寫入 CloudWatch 所需的許可。
注意
此角色不需要 SageMaker AI 或 Bedrock 許可。aws:SourceAccount 和 aws:SourceArn條件會將角色假設限制為您帳戶中的 Lambda 函數，以防止混淆代理人攻擊。
Bedrock 角色
此角色可讓 Bedrock 在匯入自訂模型時，從 SageMaker AI 受管 S3 儲存貯體讀取模型成品。
命名慣例： SageMakerForBedrock-{domain-id}
-
使用下列信任政策建立 IAM 角色。將 取代
<ACCOUNT_ID>為您的 12 位數 AWS 帳戶 ID。{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<ACCOUNT_ID>" }, "ArnLike": { "aws:SourceArn": "arn:aws:bedrock:*:<ACCOUNT_ID>:*" } } } ] } -
將下列內嵌政策連接至角色：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerBucketReadAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}", "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSSLRequestsOnly", "Action": "s3:*", "Effect": "Deny", "Resource": [ "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}", "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}/*" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] }
注意
此角色不需要 SageMaker AI、Lambda 或 Bedrock API 許可。它只為 Bedrock 提供對 SageMaker AI 受管 S3 儲存貯體中模型成品的讀取存取權。
